hexo-theme-hipaper-keyboarddaily@1.9.0
Bugfix for A newspaper theme for Hexo.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe unconditional fixed-identifier counter creates an unconfigured third-party visitor-tracking path. The source does not establish collection details or a broader attack, so this warrants a warning rather than a block.
Static reason
No blocking static signals were detected.
Trigger
Rendering a page with this theme.
Impact
The counter can receive page-visit information from sites using the theme without an explicit per-site setting for this fixed counter.
Mechanism
The footer loads a remote counter script with a fixed identifier, regardless of the separately configured CNZZ setting.
AI rationale
The unconditional fixed-identifier counter creates an unconfigured third-party visitor-tracking path. The source does not establish collection details or a broader attack, so this warrants a warning rather than a block.
Evidence
layout/_partial/after-footer.ejs_config.ymllayout/_partial/cnzz-analytics.ejs
Network endpoints1
s11.cnzz.com/z_stat.php?id=1260716016&web_id=1260716016
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The rendered footer automatically loads a hidden third-party counter with a fixed identifier.
- The theme configuration also sets that counter identifier by default.
- A separate CNZZ integration is conditional on a configured site identifier, showing that the theme supports site-owner-configured analytics.
Evidence against
- Analytics is a theme feature, but the fixed counter in the footer runs independently of the configured CNZZ integration.
Behavioral surface
FilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
3 flaggedlayout/_partial/after-footer.ejsView file
16<div style="display: none;">
<script src="https://s11.cnzz.com/z_stat.php?id=1260716016&web_id=1260716016" language="JavaScript"></script>
</div>
<%- partial('post/mathjax.ejs')
Medium
Ai Review Evidence
The rendered footer automatically loads a hidden third-party counter with a fixed identifier.
layout/_partial/after-footer.ejsView on unpkg · L16_config.ymlView file
135# CNZZ count
cnzz_siteid: 1260716016
# Pagination
## Set per_page to 0 to d
Medium
Ai Review Evidence
The theme configuration also sets that counter identifier by default.
_config.ymlView on unpkg · L135layout/_partial/cnzz-analytics.ejsView file
Findings
4 Medium3 Low
MediumNetwork
MediumAi Review Evidencelayout/_partial/after-footer.ejs
MediumAi Review Evidence_config.yml
MediumAi Review Evidencelayout/_partial/cnzz-analytics.ejs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to hexo-theme-hipaper-keyboarddaily@1.9.0.
See all versions of hexo-theme-hipaper-keyboarddaily for other recorded verdicts.
- Review the evidence and your use of hexo-theme-hipaper-keyboarddaily@1.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.